Computer Intruder Is Put on Probation And Fined $10,000

By JOHN MARKOFF, Special to The New York Times

Published: May 5, 1990

SYRACUSE, May 4—
Saying the punishment of prison did not fit the crime, a Federal judge today placed a 24-year-old computer science student on three years' probation for intentionally disrupting a nationwide computer network. The student, Robert Tappan Morris, was also fined $10,000 and ordered to perform 400 hours of community service.

The sentencing of Mr. Morris had been awaited with great interest by computer security experts and those who try to evade them.

The case, which began when Mr. Morris wrote a program that copied itself wildly in thousands of separate machines in November 1988, has become a symbol of the vulnerabilities of the computer networks that serve as the nation's highways in the age of instant information.

Legal experts said the Government's decision to prosecute Mr. Morris, after an eight-month debate in the Justice Department, sent a strong message that tampering with computers, even when not intentionally destructive, was not acceptable. When Mr. Morris was found guilty last January, he became the first person convicted by a jury under the Federal Computer Fraud and Abuse Act of 1986.

After his sentencing today by Federal District Judge Howard G. Munson, Mr. Morris said he would not comment on the case. But his parents said the family was tremendously relieved that he was not being sent to prison. His mother, Anne Morris, said, ''I still don't feel that in any way, shape or form my son is a felon.''

His father, Robert Morris, a computer security expert at the National Security Agency, said it would be his son's decision whether to appeal the guilty verdict and whether he would choose to reapply for admission to Cornell University.

His lawyer, Thomas A. Guidoboni, said he planned to appeal his client's conviction.

Mr. Morris was suspended from Cornell last year after a university board of inquiry found that he had acted irresponsibly. But the board said he could reapply for readmission later.

Frederick J. Scullin, the United States Attorney for the Northern District of New York, said the Justice Department would have to decide if the Government would appeal the judge's sentence. But he said the Government believed it had already sent a strong message to those who would tamper with computer networks. The department has 30 days to file an appeal.

Sentence Seen as a Message

''I think Judge Munson's attempt to fashion a fair sentence was admirable, and I don't think it will weaken the resolve of the Federal authorities,'' Mr. Scullin said. ''It should be a message to all would-be computer hackers.''

In sentencing Mr. Morris, Judge Munson said he realized the case had bitterly divided people in the computer industry and throughout the country over whether Mr. Morris should serve time in prison for his crime.

At the sentencing hearing today in Federal District Court here, Government lawyers said that because of the unusual nature of the case, the Government had decided not to recommend a sentence.

Judge Munson, who on several occasions in the trial had questioned the wisdom of a felony charge in the case, said he believed that punishment under the guidelines set out for a crime involving fraud and deceit did not apply in Mr. Morris's case.

''The characteristics of this case were not those of fraud and deceit,'' he said, adding that he had carefully studied the Federal sentencing guidelines for parallels in other crimes involving property damage but found that they did not apply, either.

If Judge Munson had chosen to adhere to the sentencing guidelines, Mr. Morris faced from 21 to 27 months in prison.

Federal judges are obliged in almost all cases to follow guidelines for criminal sentences, which became effective on Nov. 1, 1987.

The Federal guidelines create a point system that add and subtract mitigating and aggravating circumstances, depending on an individual's conduct and the circumstances surrounding the case. Factors that would have applied in Mr. Morris's case included the amount of property damage, whether or not a special skill was required, the amount of prior planning and whether the defendant took responsibility for his actions.

Judges can depart from the rules, but only with a written explanation, and sentences are subject to appeal by both sides.

Because the guidelines apply only to crimes committed after November 1987, there has been limited opportunity, lawyers say, to see how often judges are seeking to make such exceptions.

The recommendation of Mr. Morris's probation officer, who did not depart from the sentencing guidelines, called for a prison term of 15 to 21 months. But the probation officer's report noted that the crime did not match existing crimes.

Government prosecutors had painted a picture of a young man who made ''a deliberate and full-scale attack'' on the computer network Internet, which is made up of computers at corporate, university and military sites and is composed of 1,200 separate networks. The best estimates of the total number of computer users on the Internet now exceeds two million.

An Experimental Program

Mr. Morris's defense centered on the contention that he had not intended his program to halt the network. The defendant testified that he had written the program as an experiment and that a design error had caused it to copy itself far more rapidly than he had expected, halting thousands of computers as it spread.

The program, which Mr. Morris wrote in his first months as a graduate student at Cornell, had been designed to hide in the network, but because of a single inaccuracy it multiplied far more quickly than intended, halting computers within minutes.

Many computer security experts said that the case was a poor one to use to try to set an example for those who would try to break into the nation's computers.

''This wasn't the appropriate test case,'' said Peter Neumann, a computer scientist who specializes in computer security issues at SRI International in Menlo Park, Calif. But he said that the case did highlight the many security flaws in the nation's computer networks and pointed up the fact that much work still needs to be done to improve computer security.

''We have an opportunity to improve things,'' he said. ''We better take that lesson away from this trial.''

Photo: Robert Tappan Morris, who was convicted of writing a program that disrupted a nationwide computer network, was sentenced yesterday to three years' probation. He was accompanied by his mother, Anne, as he arrived at Federal District Court in Syracuse. (Bob Mahoney for The New York Times)(pg9)